@deepseekcode/cli@1.0.10: Suspicious npm security report (Warn)

Loading npm security reports…

@deepseekcode/cli@1.0.10: Suspicious npm security report (Warn) | LPM Firewall

Source & flagged code

17 flagged

web/dist/assets/SessionGrid-BPcnOjbx.jsView file

Lines 1-21javascript

1import{j as r,M as Yr,P as Jr}from"./markdown-BUScHEtT.js";import{R as H,r as S,w as Zr,aq as rr,k as it,a as lt,i as nn,at as sr,X as rn,au as Qr,o as ct,d as Tn,b as or,am as ar,F as Gt,av as Wt,aw as qr,D as es,v as ts,N as ns,a6 as rs,ax as En,ay as ss,p as Rt,B as os,a0 as as,az as is,y as ls,aA as cs,aB as ds,aj as us,aC as ps,ah as ms,u as hs,aD as fs,L as xs}from"./icons-uody4X-4.js";import{x as gs}from"./react-vendor-C5NlWs7r.js";import{i as Me,e as Re,w as De,j as yn,u as st,a as Vt,t as Pe,k as Oe,W as bs,l as vs,m as Kt,b as Ss,n as Nn,d as ws,S as ks}from"./index-Bpfxw0Lr.js";impo ...

2`).replace(/\n{3,}/g,`

High

Child Process

Package source references child process execution.

web/dist/assets/SessionGrid-BPcnOjbx.jsView on unpkg · L1

4`);return r.jsx("div",{className:`markdown-content ${e}`,style:{wordBreak:"break-word"},children:r.jsx(Yr,{components:{code({className:l,children:d,...u}){const f=/language-(\w+)/.exec(l||""),x=String(d).replace(/\n$/,"");return f&&f[1]?r.jsx(ta,{language:f[1],code:x}):r.jsx("code",{className:"bg-dark-hover px-1.5 py-0.5 rounded text-sm font-mono text-accent-blue",...u,children:d})},a({href:l,children:d}){return r.jsx("a",{href:l,target:"_blank",rel:"noopener noreferrer",className:"text-accent-blue hover:underline",children:d})},table({children:l}){return r.jsx("div",{className:"overflow-x-aut ...

5`);let n=0,s=0,o=0;for(const i of e)i.startsWith("@@")?o++:i.startsWith("+")&&!i.startsWith(

6`).map((n,s)=>{let o="text-dark-fg",i=" ";return(n.startsWith("+++")||n.startsWith("---"))&&s<3?o=

7`),n=[];let s=null;for(const o of e)o.startsWith("@@")?(s&&_t(n,s),s={leftLines:[],rightLines:[]},n.push({left:o,right:o,type:"header"})):o.startsWith("---")||o.startsWith("+++")?n.push({left:"",right:o,type:"header"}):o.startsWith("-")&&s?s.leftLines.push(o.substring(1)):o.startsWith("+")&&s?s.rightLines.push(o.substring(1)):s?(_t(n,s),n.push({left:o,right:o,type:"context"})):n.push({left:o,right:o,type:"context"});return s&&_t(n,s),r.jsxs("div",{children:[r.jsxs("div",{className:"flex border-b border-dark-border text-xs font-bold text-dark-muted",children:[r.jsx("div",{className:"flex-1 px-2 ...

8`)})]}),e.action&&r.jsxs("div",{className:"py-0.5 px-2 text-xs border-l-2 border-accent-yellow/40 bg-accent-yellow/5 rounded-r",children:[r.jsx("div",{className:"flex items-center gap-1 text-accent-yellow mb-0.5",children:"⚡ 执行"}),r.jsx("div",{className:"text-dark-text leading-snug font-mono text-[11px]",children:e.action})]}),e.toolCalls&&e.toolCalls.length>0&&e.toolCalls.map(

10`)})}),r.jsx(er,{ts:e.timestamp,align:"right",children:r.jsx(qn,{message:e,sessionId:n,onRegenerate:s,onDeleteMessage:o})})]})}):f?r.jsx("div",{className:"flex justify-center animate-fade-in-up px-1 py-1",children:r.jsx("div",{className:"text-[11px] text-dark-muted bg-dark-surface border border-dark-border/60 rounded-full px-3.5 py-1 max-w-[90%] text-center",children:e.content})}):r.jsx("div",{className:"group flex animate-fade-in-up px-1",children:r.jsxs("div",{className:"w-full max-w-full",children:[r.jsx(er,{ts:e.timestamp,align:"left",children:r.jsx(qn,{message:e,sessionId:n,onRegenerate:s ...

12`)})]}),e.toolCalls&&e.toolCalls.length>0&&!e.hookApproval&&r.jsx("div",{className:"mb-1 space-y-0.5",children:e.toolCalls.map(b=>r.jsx(Gr,{toolCall:b},b.id))})]}),e.content?r.jsx("div",{className:"leading-relaxed",children:r.jsx(na,{content:e.content.

14`)})}):!e.thinking&&!e.hookApproval&&((v=e.steps)!=null&&v.length)?null:!e.thinking&&!e.hookApproval&&!((T=e.steps)!=null&&T.length)&&a

15`)}

17`:""},[v,a]),J=S.useCallback(R=>{const V=R.clipboardData.getData("text/plain");if(R.clipboardData.files&&R.clipboardData.files.length>0){R.

18 resize-none focus:outline-none min-h-[44px] max-h-[40vh] leading-relaxed

19 disabled:opacity-50 disabled:cursor-not-allowed`}),r.jsxs("div",{className:"flex items-center gap-2 px-2.5 pb-2.5",children:[r.jsx(Ta,{}),r.jsx("span",{className:"text-[11px] text-dark-muted/80 font-mono truncate max-w-[10rem] hidden sm:block",children:I||""}),r.jsx("div",{className:"flex-1"}),C>0&&c.length>0&&r.jsxs("span",{className:`text-[10px] tabular-nums ${Ae?"text-accent-red font-medium":"text-dark-muted/60"}`,children:["~",C," tokens",Ae?` · ${a("chat.nearLimit")}`:""]}),!d&&r.jsx("button",{onClick:()=>void O(),className:"flex h-8 w-8 items-center justify-center ro ...

20 hover:opacity-80 active:scale-95 disabled:opacity-25 disabled:cursor-not-allowed`,title:a("chat.sendBtn"),"aria-label":a("chat.sendBtn"),children:r.jsx(hs,{size:15,"aria-hidden":"true"})})]})]}),r.jsxs("div",{className:"mt-1.5 hidden sm:flex items-center justify-center gap-3 text-[10px] text-dark-muted/50 select-none",children:[r.jsx("span",{children:a("chat.shiftEnter"

Long lines were clipped for display.

web/dist/assets/SkillsView-m_a2rauP.jsView file

Lines 1-2javascript

1import{j as e}from"./markdown-BUScHEtT.js";import{r as l,p as A,o as X,ab as Z,P as ee,ac as se,a8 as O,a9 as $,ad as U,ae as

dist/cli.jsView file

1#!/usr/bin/env node L2: if(!process.env.DSC_NODE_ENV){process.env.DSC_NODE_ENV='1';process.env.NODE_ENV='production';} L3: if(!process.execArgv.some(a=>a.includes('max-old-space-size'))&&!process.env.NODE_OPTIONS?.includes('max-old-space-size')&&!process.env.DSC_RELAUNCHED){process.env.DSC_RELAUNCHED='... L4: import { createRequire as __clsCr } from 'module'; ... L7: __clsInitRequire(); L8: import{createRequire as w_8}from"node:module";var M_8=Object.create;var U_8=Object.getPrototypeOf;var HE=Object.defineProperty;var F_8=Object.getOwnPropertyNames;var L_8=Object.pro... L9: at`)?" (<anonymous>)":-1<N.stack.indexOf("@")?"@unknown:0:0":""}return`

Critical

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution with blocking evidence.

dist/cli.jsView on unpkg · L1

Critical

Credential Exfiltration

Source appears to send environment or credential material to an external endpoint.

dist/cli.jsView on unpkg · L1

Source & flagged code

17 flagged · loading source

web/dist/assets/SessionGrid-BPcnOjbx.jsView file

1import{j as r,M as Yr,P as Jr}from"./markdown-BUScHEtT.js";import{R as H,r as S,w as Zr,aq as rr,k as it,a as lt,i as nn,at as sr,X as rn,au as Qr,o as ct,d as Tn,b as or,am as ar,... L2: `).replace(/\n{3,}/g,`

High

Child Process

Package source references child process execution.

web/dist/assets/SessionGrid-BPcnOjbx.jsView on unpkg · L1

web/dist/assets/SkillsView-m_a2rauP.jsView file

1import{j as e}from"./markdown-BUScHEtT.js";import{r as l,p as A,o as X,ab as Z,P as ee,ac as se,a8 as O,a9 as $,ad as U,ae as te}from"./icons-uody4X-4.js";import"./Toast-CcbSW0V2.j...

Medium

Dynamic Require

Package source references dynamic require/import behavior.

web/dist/assets/SkillsView-m_a2rauP.jsView on unpkg · L1

dist/cli.jsView file

Critical

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution with blocking evidence.

dist/cli.jsView on unpkg · L1

Critical

Credential Exfiltration

Source appears to send environment or credential material to an external endpoint.

dist/cli.jsView on unpkg · L1

75L76: [truncated]`:K,path:this.relative(J),size:aI8(J).size,truncated:X}}fileTree(D=".",z=2,J=200){const K=this.resolve(D);let X=0;const q=(Y,G)=>{X+=1;const Z=iI8(Y);const H=this.relati... L77: })`,{filename:"workflow-script.js"});const q=X.runInContext(K,{timeout:1000});const Y=await q(J);if(!Y){return L3({title:z.message||"Workflow",description:z.message||"Workflow",goa... ... L79: `)}const X=this.getPrimitive(D);if(X?.kind==="agent"){return await this.executeAgentPrimitive(X,D,z)}if(X?.kind==="tool"){return await this.executeToolPrimitive(X,D,z)}const q=this... L80: `)}const G=this.evalExpression(Y,this.expressionContext(z,K),z,D);let Z;const H=q.cases&&typeof q.cases==="object"?q.cases:undefined;if(H){const O=H[String(G)];if(typeof O==="strin... L81: `)} L82: `}function vT(D){if(

Source & flagged code

17 flagged

web/dist/assets/SessionGrid-BPcnOjbx.jsView file

Lines 1-21javascript

2`).replace(/\n{3,}/g,`

High

Child Process

Package source references child process execution.

web/dist/assets/SessionGrid-BPcnOjbx.jsView on unpkg · L1

5`);let n=0,s=0,o=0;for(const i of e)i.startsWith("@@")?o++:i.startsWith("+")&&!i.startsWith(

6`).map((n,s)=>{let o="text-dark-fg",i=" ";return(n.startsWith("+++")||n.startsWith("---"))&&s<3?o=

14`)})}):!e.thinking&&!e.hookApproval&&((v=e.steps)!=null&&v.length)?null:!e.thinking&&!e.hookApproval&&!((T=e.steps)!=null&&T.length)&&a

15`)}

17`:""},[v,a]),J=S.useCallback(R=>{const V=R.clipboardData.getData("text/plain");if(R.clipboardData.files&&R.clipboardData.files.length>0){R.

18 resize-none focus:outline-none min-h-[44px] max-h-[40vh] leading-relaxed

Long lines were clipped for display.

web/dist/assets/SkillsView-m_a2rauP.jsView file

Lines 1-2javascript

1import{j as e}from"./markdown-BUScHEtT.js";import{r as l,p as A,o as X,ab as Z,P as ee,ac as se,a8 as O,a9 as $,ad as U,ae as

dist/cli.jsView file

Critical

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution with blocking evidence.

dist/cli.jsView on unpkg · L1

Critical

Credential Exfiltration

Source appears to send environment or credential material to an external endpoint.

dist/cli.jsView on unpkg · L1

@deepseekcode/cli@1.0.10

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Source & flagged code